System Threats

System Threats

1. Malware

   • Is software written to infect computers by exploiting vulnerabilities in operating systems
     • Definition
     • The computer may crash, become slow and or files may be deleted or become corrupt. However the worst effects are the ones you don't see, e.g. it may record your keystrokes
       • Effects
       • Strong security software, enable OS updates, Staff training and backing up files all help to prevent malware
         • Prevention

2. Phishing

   • Phishing is an online fraud technique to entice you to disclose personal information by disguising as a trustworthy entity in an electronic communication
     • Access to the victims's account, open new bank accounts, gain high-value corporate data are all effects of phishing
       • Strong security software and Staff training are both ways to prevent phishing
         • Prevention
       • Effects
     • Definition

3. Brute Force Attack

   • Is a trial and error method used to decode encrypted data through exhaustive effort
     • Theft of data and access to corporate and private computer systens
       • Network lockout policy, using effective passwords and challenge response tests ( robot or not )
         • Prevention
       • Effects
     • Definition

4. Denial of Service Attack

   • Flooding a server with useless traffic causes servers to become overloaded preventing them responding to legitimate client-server requests from users.
     • Money loss, productivity loss and reputation damage
       • Strong security (firewall), good network policy and configuration of the webserver
         • Prevention
       • Effects
     • Definiton

5. Data Interception and theft

   • An attacker monitors data streams to or from a target, in order to gather sensitive information. This attack usually involves sniffing network traffic
     • Discovering username and password credentials, gaining access to systems., disclosure of corporate data., theft of data.
       • Strong encryption, using virtual networks, staff training: use of passwords, locking and portable storage devices, network forensics.
         • Prevention
       • Effects
     • Definition

6. SQL Injection

   • SQL injection is a code injection technique, used to attack data-driven applications
     • Contents of the database can be output, revealing data that otherwise would be hidden, data in the database can be amended and deleted, new rogue records can be added.
       • Validation of input fields, using parameterised queries, using database permissions, penetration testing.
         • Prevention
       • Effects
     • Definition